Dissecting the Hack This page intentionally left blank Dissecting the Hack The F0rb1dd3n Network Jayson E. Street Kent Nabors AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SYNGRESS SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO ® Syngress is an imprint of Elsevier Syngress is an imprint of Elsevier 30 Corporate Drive, Suite 400, Burlington, MA 01803, USA Linacre House, Jordan Hill, Oxford OX2 8DP, UK Dissecting the Hack: The F0rb1dd3n Network © 2010 ELSEVIER Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our Web site: www.elsevier.com/ permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this fi eld are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such informa- tion or methods, they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors assume any liability for any injury or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-478-6 ISBN: 978-1-59749-478-6 For information on all Syngress publications visit our Web site at www.syngress.com Printed in the United States of America 09 10 11 12 13 10 9 8 7 6 5 4 3 2 1 Typeset by: diacriTech, Chennai, India Elsevier Inc., the author(s), and any person or fi rm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and Rights; e-mail [email protected] Publisher: Laura Colantoni Acquisitions Editor: Rachel Roumeliotis Assistant Editor: David Bevans Project Manager: Julie Ochs To Earl L. Street All that I am and part of what my children will become is because of who you were. Thank you and I miss and think of you everyday. To Dee Drake and Aliera For all the love you give me thank you. Also for putting up with me when I am there and missing me when I am away. This page intentionally left blank Contents Foreword ................................................................................................................ xvii Acknowledgements .................................................................................................. xix H0w t0 R34d Dissecting The Hack: The F0rb1dd3n Network .............................. xxi Author Biographies ................................................................................................xxiii PART 1 F0RB1DD3N PR010GU3 ................................................................................................................ 3 A New Assignment ............................................................................. 3 CHAPTER 0N3 ........................................................................................................ 15 Problem Solved ............................................................................... 15 Getting Started ................................................................................. 20 The Acquisition ................................................................................ 22 CHAPTER TW0 ....................................................................................................... 27 Just Another Day............................................................................... 27 The Installation ................................................................................ 32 CHAPTER THR33 ................................................................................................... 35 In Country ........................................................................................35 CHAPTER F0UR ...................................................................................................... 47 In Real Life ....................................................................................... 47 CHAPTER F1V3 ...................................................................................................... 57 Status Check .....................................................................................57 Log Review ....................................................................................... 63 CHAPTER S1X ........................................................................................................ 69 The Meeting ..................................................................................... 69 First Lead ..........................................................................................72 The Discovery .................................................................................. 75 CHAPTER S3V3N ................................................................................................... 81 Code Review .................................................................................... 81 CHAPTER E1GHT .................................................................................................... 91 Battle Plans .......................................................................................91 Data Collection ................................................................................ 96 vii viii Contents CHAPTER N1N3 ................................................................................................... 105 Data Analysis................................................................................... 105 Shrinking Team ............................................................................... 106 Tenuous Connections .................................................................... 107 Loose Ends ..................................................................................... 112 Expendable Assets .......................................................................... 115 CHAPTER T3N ...................................................................................................... 119 Choosing Sides ............................................................................... 119 3P1L0GU3 ............................................................................................................. 127 End Process ....................................................................................127 PART 2 SECURITY THREATS ARE REAL (STAR) STAR INTRODUCTION .......................................................................................... 131 Recon ............................................................................................. 131 Scanning ......................................................................................... 131 Exploring ....................................................................................... 132 Exploiting ....................................................................................... 132 Expunging ...................................................................................... 132 Bleeding Edge .................................................................................132 Hacking Culture ............................................................................. 133 CHAPTER 1 Recon .............................................................................................. 135 Fictional Story Dissected: U.S. Securities and Exchange Commission .........................................................137 Fictional Story Dissected: Harvesting Addresses ............................ 138 Public Record on Tap: Real-Time E-mail Harvesting ....................... 140 Maltego ...........................................................................................141 Google ............................................................................................ 143 Netcraft .......................................................................................... 143 Sam Spade ...................................................................................... 144 Public Record on Tap: Sam Spade ...................................................144 DNSpredict ..................................................................................... 146 Books.............................................................................................. 147 CHAPTER 2 Scanning ........................................................................................